From f431e81ce6bb3df1adf55e45a8c62a4751675cf1 Mon Sep 17 00:00:00 2001 From: Erik Simon Date: Thu, 6 Aug 2026 03:31:46 +0200 Subject: [PATCH] tailscale: drop the 1.98.9 vendorHash override MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit c5a231b pinned the hash by hand because nixpkgs bumped 1.98.8->1.98.9 without updating vendorHash (NixOS/nixpkgs#545860). The previous commit's lock moves nixos-26.05 past the point where that fix was promoted from release-26.05, so the override is now dead weight — and a stale vendorHash override is worse than none, since it silently wins over a correct upstream value on the next version bump. Co-Authored-By: Claude Opus 5 --- services/vpn/tailscale.nix | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/services/vpn/tailscale.nix b/services/vpn/tailscale.nix index 8c874af..86e93d7 100644 --- a/services/vpn/tailscale.nix +++ b/services/vpn/tailscale.nix @@ -5,19 +5,6 @@ # to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix). # Not for the VM (no sops). { - # TEMPORARY: nixpkgs bumped tailscale 1.98.8->1.98.9 without updating - # vendorHash (NixOS/nixpkgs#545860, fixed on the `release-26.05` branch - # 2026-07-26 but not yet promoted to the `nixos-26.05` channel branch this - # flake tracks). Remove this override once `nix flake lock --update-input - # nixpkgs` picks up a nixos-26.05 rev at/after that fix. - nixpkgs.overlays = [ - (final: prev: { - tailscale = prev.tailscale.overrideAttrs (old: { - vendorHash = "sha256-Sd2iLJ7eDfDYdIRuW4xuiKgzhQWJWGAnz97FJWrVRlE="; - }); - }) - ]; - services.tailscale = { enable = true; openFirewall = true; # UDP 41641 for direct connections